GoKawiilDigital identities and what they mean for the web have become a hot topic of discussion in the last few years. They have also brought many controversies: age verification laws and what they mean for online anonymity, Wikipedia potentially having to verify the identify of its users in the UK, the reliance on official iOS and Android operating systems as mandatory form factors for digital identity wallets, not to mention what these inter-dependencies mean when your US digital accounts are cancelled for being a judge at the International Criminal Court.
My story is about the Swiss governmental login system AGOV. Deployed since 2024, it now counts 1.6 million accounts and it is increasingly becoming the login mechanism to benefit from unemployment insurance, file taxes (a mandatory activity!), and many other interactions. In the canton of Zurich, this is the only entry point to apply for citizenship.
So I eventually had to create an AGOV account. Unfortunately, registering an account proved to be a real challenge, until I got the bottom of a weird accessibility bug. Inspired by Just Let Me Select Text, it’s my turn to present you Just Let Me Write Digits.
The first step of the AGOV registration process is to provide your email address and enter a verification code to validate the address. My problem was that I couldn’t even enter this code!
To set the context, the form to enter the verification code is split into 6 boxes (one per digit). The first weird thing was that every time I typed a digit, the focus wouldn’t automatically jump to the next box. Instead, the current box would accumulate more digits and highlight them in red, indicating an error.
At first, I thought that this was just a minor UI bug, and that I could manually jump to the next box after each digit. However, this didn’t work and the page would always display a “field required” error at the end, even when I carefully filled one digit per box. Strange.
I tried looking at the DOM in the developer tools to see if there was a form value I could manually adjust, but nothing obvious stood out. No error message was logged either in the web console. Using a different email address, or even a fake one like [email protected] didn’t make any difference.
Given that I was browsing the web with Firefox on Linux, I thought that maybe this combination was unsupported or failing a CAPTCHA. This would be unlikely – I barely encounter any website broken specifically on Firefox or Linux these days – but not impossible. Indeed, the registration page connects to eu-api.friendlycaptcha.eu just before the verification code form appears. And the official AGOV documentation only mentions Windows and macOS as supported operating systems, even though a different page about security keys states that Linux and Firefox are supported.
To rule this out, I ended up trying 6 combinations of browsers and operating systems: Firefox, Chromium and Chrome on Linux; Firefox, Safari and Chrome on macOS. All of them showed the same error!
At this point I thought it’d make sense to contact the official support. The AGOV website has many help sections, but unfortunately, this didn’t lead me very far because the only way to contact support is via a web form… that starts by sending a verification code to your email! The exact same form I couldn’t pass.
... continue reading